Lambda
Prefix lambda, 135 actions · Domain Serverless
32 AWS managed policies. 5 have reviewed guidance; the rest have authoritative permission data pending editorial review. 8 are service-linked role policies, shown with permission data only.
User access (8)
- AmazonDynamoDBFullAccesswithDataPipelineHigh privilegeAdmin
- AWSLambda_FullAccessAdmin
- AWSLambda_ReadOnlyAccessAnalyst
- AWSLambdaFullAccessHigh privilegeAdmin
- CloudWatchAutomaticDashboardsAccessReader
- CloudWatchSyntheticsFullAccessAdmin
- DataScientistHigh privilegeAdmin
- SecretsManagerReadWriteAdmin
Operator and limited (6)
Service roles (10)
- AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicyOperator
- AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicyOperator
- AmplifyBackendDeployFullAccessOperator
- AWSCodeDeployRoleForCloudFormationOperator
- AWSCodeDeployRoleForLambdaOperator
- AWSCodeDeployRoleForLambdaLimitedOperator
- AWSLambdaBasicDurableExecutionRolePolicyOperator
- AWSLambdaRoleOperator
- SageMakerStudioBedrockFlowServiceRolePolicyOperator
- SageMakerStudioQueryExecutionRolePolicyOperator
Service-linked roles (8)
- AWSApplicationAutoscalingLambdaConcurrencyPolicyOperator
- AWSBudgetsSpendLimitMemberRolePolicyOperator
- AWSContinuumCollectorServiceRolePolicyOperator
- AWSLambdaReplicatorOperator
- AWSRoboMakerServicePolicyOperator
- ClientVPNServiceConnectionsRolePolicyOperator
- Route53RecoveryReadinessServiceRolePolicyOperator
- SecurityLakeResourceManagementServiceRolePolicyOperator
Also grants Lambda actions (93)
- AccessAnalyzerServiceRolePolicy
- AdministratorAccess
- AdministratorAccess-Amplify
- AIDevOpsAgentAccessPolicy
- AIDevOpsAgentActionsPolicy
- AIOpsAssistantPolicy
- AmazonAppFlowFullAccess
- AmazonBedrockStudioPermissionsBoundary
- AmazonCognitoPowerUser
- AmazonConnect_FullAccess
- AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary
- AmazonDevOpsGuruServiceRolePolicy
- AmazonDynamoDBFullAccess
- AmazonDynamoDBFullAccess_v2
- AmazonDynamoDBReadOnlyAccess
- AmazonECS_FullAccess
- AmazonGuardDutyServiceRolePolicy
- AmazonInspector2ServiceRolePolicy
- AmazonLaunchWizard_Fullaccess
- AmazonLaunchWizardFullAccessV2
- AmazonLexFullAccess
- AmazonRedshiftAllCommandsFullAccess
- AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy
- AmazonSageMakerFullAccess
- AmazonSageMakerGroundTruthExecution
- AmazonSageMakerJobFullAccess
- AmazonSageMakerModelCustomizationCoreAccess
- AmazonSecurityLakeAdministrator
- AmazonSSMAutomationRole
- AmazonSSMMaintenanceWindowRole
- AmazonSSMServiceRolePolicy
- AmazonWorkMailFullAccess
- AmazonWorkMailReadOnlyAccess
- AssuranceServiceRolePolicy
- AWS_ConfigRole
- AWSApplicationMigrationNetworkMigrationMultiAccount
- AWSAuditManagerServiceRolePolicy
- AWSCloudTrail_FullAccess
- AWSCODAPermissionsBoundary
- AWSCodeCommitFullAccess
- AWSCodeCommitPowerUser
- AWSCodeCommitReadOnly
- AWSCodeDeployRoleForECS
- AWSCodeDeployRoleForECSLimited
- AWSCodePipeline_FullAccess
- AWSConfigServiceRolePolicy
- AWSDeepLensServiceRolePolicy
- AWSDeepRacerCloudFormationAccessPolicy
- AWSDeepRacerServiceRolePolicy
- AWSElasticBeanstalkServiceRolePolicy
- AWSFinOpsAgentServiceRolePolicy
- AWSGreengrassResourceAccessRolePolicy
- AWSIoTDeviceTesterForGreengrassFullAccess
- AWSMcpServiceActionsFullAccess
- AWSMobileHub_FullAccess
- AWSMobileHub_ReadOnly
- AWSPanoramaServiceRolePolicy
- AWSPartnerLedSupportReadOnlyAccess
- AWSQuickSetupPatchPolicyDeploymentRolePolicy
- AWSQuickSetupPatchPolicyPermissionsBoundary
- AWSResilienceHubAsssessmentExecutionPolicy
- AWSResilienceHubV2AssessmentExecutionPolicy
- AWSResourceExplorerServiceRolePolicy
- AWSSecurityHubV2ServiceRolePolicy
- AWSStepFunctionsConsoleFullAccess
- AWSSupportServiceRolePolicy
- AWSThinkboxDeadlineResourceTrackerAccessPolicy
- AWSTransformInfrastructureExecutorAccessBatch
- AWSTransformNetworkMigrationAgentPolicy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- BedrockAgentCoreFullAccess
- ClientVPNServiceRolePolicy
- CloudWatchApplicationInsightsFullAccess
- CloudwatchApplicationInsightsServiceLinkedRolePolicy
- CloudWatchOmniAWSIntegrationPolicy
- CloudWatchOmniSpaceAccessPolicy
- ComputeOptimizerReadOnlyAccess
- DatabaseAdministrator
- FinOpsAgentAgentPolicy
- PowerUserAccess
- ReadOnlyAccess
- ResourceGroupsTaggingAPITagUntagSupportedResources
- SageMakerStudioBedrockAgentServiceRolePolicy
- SageMakerStudioProjectProvisioningRolePolicy
- SageMakerStudioProjectUserRolePermissionsBoundary
- SageMakerStudioProjectUserRolePolicy
- SecurityAudit
- SupportUser
- SystemAdministrator
- ViewOnlyAccess
- VPCLatticeFullAccess
- VPCLatticeReadOnlyAccess
- WellArchitectedAgentResourceScanning
addlayerversionpermission addpermission checkpointdurableexecution connectmicrovm createalias createcapacityprovider createcodesigningconfig createeventsourcemapping createfunction createfunctionurlconfig createmicrovmauthtoken createmicrovmimage createmicrovmshellauthtoken createnetworkconnector createwebfunction createwebfunctionendpoint createwebfunctionrevision deletealias deletecapacityprovider deletecodesigningconfig deleteeventsourcemapping deletefunction deletefunctioncodesigningconfig deletefunctionconcurrency deletefunctioneventinvokeconfig deletefunctionurlconfig deletelayerversion deletemicrovmimage deletemicrovmimageversion deletenetworkconnector deleteprovisionedconcurrencyconfig deleteresourcepolicy deletewebfunction deletewebfunctionendpoint deletewebfunctionrevision disablereplication enablereplication getaccountsettings getalias getcapacityprovider getcodesigningconfig getdurableexecution getdurableexecutionhistory getdurableexecutionstate geteventsourcemapping getfunction getfunctioncodesigningconfig getfunctionconcurrency getfunctionconfiguration getfunctioneventinvokeconfig getfunctionrecursionconfig getfunctionscalingconfig getfunctionurlconfig getlayerversion getlayerversionpolicy getmicrovm getmicrovmimage getmicrovmimagebuild getmicrovmimageversion getnetworkconnector getpolicy getprovisionedconcurrencyconfig getresourcepolicy getruntimemanagementconfig getwebaccountsettings getwebfunction getwebfunctionendpoint getwebfunctionrevision invokeasync invokefunction invokefunctionurl invokewebfunctionendpoint listaliases listcapacityproviders listcodesigningconfigs listdurableexecutionsbyfunction listeventsourcemappings listfunctioneventinvokeconfigs listfunctionurlconfigs listfunctionversionsbycapacityprovider listfunctions listfunctionsbycodesigningconfig listlayerversions listlayers listmanagedmicrovmimageversions listmanagedmicrovmimages listmicrovmimagebuilds listmicrovmimageversions listmicrovmimages listmicrovms listnetworkconnectorversions listnetworkconnectors listprovisionedconcurrencyconfigs listtags listversionsbyfunction listwebfunctionendpoints listwebfunctionrevisions listwebfunctions passcapacityprovider passnetworkconnector publishlayerversion publishversion putfunctioncodesigningconfig putfunctionconcurrency putfunctioneventinvokeconfig putfunctionrecursionconfig putfunctionscalingconfig putprovisionedconcurrencyconfig putresourcepolicy putruntimemanagementconfig removelayerversionpermission removepermission resumemicrovm runmicrovm senddurableexecutioncallbackfailure senddurableexecutioncallbackheartbeat senddurableexecutioncallbacksuccess stopdurableexecution suspendmicrovm tagresource terminatemicrovm untagresource updatealias updatecapacityprovider updatecodesigningconfig updateeventsourcemapping updatefunctioncode updatefunctioncodesigningconfig updatefunctionconfiguration updatefunctioneventinvokeconfig updatefunctionurlconfig updatemicrovmimage updatemicrovmimageversion updatenetworkconnector updatewebfunctionendpoint
Actions (135)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| lambda:AddLayerVersionPermission | Permissions management | 7 | 2 |
| lambda:AddPermission | Permissions management | 8 | 9 |
| lambda:CheckpointDurableExecution | Write | 8 | 1 |
| lambda:ConnectMicrovm | Write | 7 | 1 |
| lambda:CreateAlias | Write | 9 | 2 |
| lambda:CreateCapacityProvider | Write | 9 | 1 |
| lambda:CreateCodeSigningConfig | Write | 9 | 1 |
| lambda:CreateEventSourceMapping | Write | 12 | 3 |
| lambda:CreateFunction | Write | 14 | 21 |
| lambda:CreateFunctionUrlConfig | Write | 9 | 1 |
| lambda:CreateMicrovmAuthToken | Write | 9 | 1 |
| lambda:CreateMicrovmImage | Write | 9 | 1 |
| lambda:CreateMicrovmShellAuthToken | Write | 9 | 1 |
| lambda:CreateNetworkConnector | Write | 9 | 1 |
| lambda:CreateWebFunction | Write | 9 | 1 |
| lambda:CreateWebFunctionEndpoint | Write | 9 | 1 |
| lambda:CreateWebFunctionRevision | Write | 9 | 1 |
| lambda:DeleteAlias | Write | 9 | 2 |
| lambda:DeleteCapacityProvider | Write | 9 | 1 |
| lambda:DeleteCodeSigningConfig | Write | 9 | 1 |
| lambda:DeleteEventSourceMapping | Write | 11 | 4 |
| lambda:DeleteFunction | Write | 12 | 21 |
| lambda:DeleteFunctionCodeSigningConfig | Write | 9 | 1 |
| lambda:DeleteFunctionConcurrency | Write | 10 | 3 |
| lambda:DeleteFunctionEventInvokeConfig | Write | 9 | 1 |
| lambda:DeleteFunctionUrlConfig | Write | 9 | 1 |
| lambda:DeleteLayerVersion | Write | 10 | 3 |
| lambda:DeleteMicrovmImage | Write | 9 | 1 |
| lambda:DeleteMicrovmImageVersion | Write | 9 | 1 |
| lambda:DeleteNetworkConnector | Write | 9 | 1 |
| lambda:DeleteProvisionedConcurrencyConfig | Write | 11 | 1 |
| lambda:DeleteResourcePolicy | Permissions management | 9 | 1 |
| lambda:DeleteWebFunction | Write | 9 | 1 |
| lambda:DeleteWebFunctionEndpoint | Write | 9 | 1 |
| lambda:DeleteWebFunctionRevision | Write | 9 | 1 |
| lambda:DisableReplication | Permissions management | 7 | 2 |
| lambda:EnableReplication | Permissions management | 8 | 1 |
| lambda:GetAccountSettings | Read | 16 | 1 |
| lambda:GetAlias | Read | 24 | 5 |
| lambda:GetCapacityProvider | Read | 14 | 2 |
| lambda:GetCodeSigningConfig | Read | 22 | 3 |
| lambda:GetDurableExecution | Read | 14 | 1 |
| lambda:GetDurableExecutionHistory | Read | 13 | 1 |
| lambda:GetDurableExecutionState | Read | 14 | 1 |
| lambda:GetEventSourceMapping | Read | 24 | 5 |
| lambda:GetFunction | Read | 26 | 28 |
| lambda:GetFunctionCodeSigningConfig | Read | 23 | 4 |
| lambda:GetFunctionConcurrency | Read | 19 | 4 |
| lambda:GetFunctionConfiguration | Read | 35 | 16 |
| lambda:GetFunctionEventInvokeConfig | Read | 23 | 2 |
| lambda:GetFunctionRecursionConfig | Read | 21 | 4 |
| lambda:GetFunctionScalingConfig | Read | 17 | 3 |
| lambda:GetFunctionUrlConfig | Read | 24 | 3 |
| lambda:GetLayerVersion | Read | 22 | 6 |
| lambda:GetLayerVersionPolicy | Read | 22 | 4 |
| lambda:GetMicrovm | Read | 13 | 1 |
| lambda:GetMicrovmImage | Read | 13 | 1 |
| lambda:GetMicrovmImageBuild | Read | 13 | 1 |
| lambda:GetMicrovmImageVersion | Read | 13 | 1 |
| lambda:GetNetworkConnector | Read | 12 | 1 |
| lambda:GetPolicy | Read | 28 | 6 |
| lambda:GetProvisionedConcurrencyConfig | Read | 28 | 5 |
| lambda:GetResourcePolicy | Read | 14 | 1 |
| lambda:GetRuntimeManagementConfig | Read | 23 | 5 |
| lambda:GetWebAccountSettings | Read | 12 | 1 |
| lambda:GetWebFunction | Read | 12 | 1 |
| lambda:GetWebFunctionEndpoint | Read | 12 | 1 |
| lambda:GetWebFunctionRevision | Read | 12 | 1 |
| lambda:InvokeAsync | Write | 7 | 2 |
| lambda:InvokeFunction | Write | 13 | 40 |
| lambda:InvokeFunctionUrl | Write | 7 | 1 |
| lambda:InvokeWebFunctionEndpoint | Write | 7 | 2 |
| lambda:ListAliases | List | 29 | 5 |
| lambda:ListCapacityProviders | List | 23 | 3 |
| lambda:ListCodeSigningConfigs | List | 24 | 3 |
| lambda:ListDurableExecutionsByFunction | List | 19 | 1 |
| lambda:ListEventSourceMappings | List | 35 | 4 |
| lambda:ListFunctionEventInvokeConfigs | List | 25 | 3 |
| lambda:ListFunctionUrlConfigs | List | 24 | 4 |
| lambda:ListFunctionVersionsByCapacityProvider | List | 19 | 1 |
| lambda:ListFunctions | List | 60 | 7 |
| lambda:ListFunctionsByCodeSigningConfig | List | 20 | 1 |
| lambda:ListLayerVersions | List | 26 | 3 |
| lambda:ListLayers | List | 24 | 2 |
| lambda:ListManagedMicrovmImageVersions | List | 19 | 1 |
| lambda:ListManagedMicrovmImages | List | 19 | 1 |
| lambda:ListMicrovmImageBuilds | List | 19 | 1 |
| lambda:ListMicrovmImageVersions | List | 19 | 1 |
| lambda:ListMicrovmImages | List | 19 | 1 |
| lambda:ListMicrovms | List | 19 | 1 |
| lambda:ListNetworkConnectorVersions | List | 18 | 1 |
| lambda:ListNetworkConnectors | List | 18 | 1 |
| lambda:ListProvisionedConcurrencyConfigs | List | 25 | 3 |
| lambda:ListTags | Read | 27 | 11 |
| lambda:ListVersionsByFunction | List | 28 | 10 |
| lambda:ListWebFunctionEndpoints | List | 18 | 1 |
| lambda:ListWebFunctionRevisions | List | 18 | 1 |
| lambda:ListWebFunctions | List | 18 | 1 |
| lambda:PassCapacityProvider | Write | 7 | 1 |
| lambda:PassNetworkConnector | Write | 7 | 1 |
| lambda:PublishLayerVersion | Write | 7 | 4 |
| lambda:PublishVersion | Write | 10 | 5 |
| lambda:PutFunctionCodeSigningConfig | Write | 7 | 1 |
| lambda:PutFunctionConcurrency | Write | 8 | 3 |
| lambda:PutFunctionEventInvokeConfig | Write | 7 | 1 |
| lambda:PutFunctionRecursionConfig | Write | 7 | 1 |
| lambda:PutFunctionScalingConfig | Write | 7 | 1 |
| lambda:PutProvisionedConcurrencyConfig | Write | 9 | 2 |
| lambda:PutResourcePolicy | Permissions management | 7 | 1 |
| lambda:PutRuntimeManagementConfig | Write | 7 | 1 |
| lambda:RemoveLayerVersionPermission | Permissions management | 7 | 2 |
| lambda:RemovePermission | Permissions management | 7 | 6 |
| lambda:ResumeMicrovm | Write | 7 | 1 |
| lambda:RunMicrovm | Write | 7 | 1 |
| lambda:SendDurableExecutionCallbackFailure | Write | 7 | 1 |
| lambda:SendDurableExecutionCallbackHeartbeat | Write | 7 | 1 |
| lambda:SendDurableExecutionCallbackSuccess | Write | 7 | 1 |
| lambda:StopDurableExecution | Write | 7 | 1 |
| lambda:SuspendMicrovm | Write | 7 | 1 |
| lambda:TagResource | Tagging | 9 | 12 |
| lambda:TerminateMicrovm | Write | 7 | 1 |
| lambda:UntagResource | Tagging | 9 | 6 |
| lambda:UpdateAlias | Write | 11 | 2 |
| lambda:UpdateCapacityProvider | Write | 9 | 1 |
| lambda:UpdateCodeSigningConfig | Write | 9 | 1 |
| lambda:UpdateEventSourceMapping | Write | 9 | 3 |
| lambda:UpdateFunctionCode | Write | 10 | 14 |
| lambda:UpdateFunctionCodeSigningConfig | Write | 9 | 3 |
| lambda:UpdateFunctionConfiguration | Write | 10 | 12 |
| lambda:UpdateFunctionEventInvokeConfig | Write | 9 | 3 |
| lambda:UpdateFunctionUrlConfig | Write | 9 | 3 |
| lambda:UpdateMicrovmImage | Write | 9 | 1 |
| lambda:UpdateMicrovmImageVersion | Write | 9 | 1 |
| lambda:UpdateNetworkConnector | Write | 9 | 1 |
| lambda:UpdateWebFunctionEndpoint | Write | 9 | 1 |